Mutable rich session objects don't work with session's saveDelta()

When a mutable object is referenced in a fetched session, and that object is modified, the attribute is never put into the delta list for saving to redis.

This was observed using spring-session with spring-security-oauth2, specifically with org.springframework.security.oauth2.provider.endpoint.AuthorizationEndpoint and it's @SessionAttrtibutes("authorizationRequest") annotation. While the authorizationRequest object (map in this case) is modified, the attribute "authorizationRequest" is not entered into the delta. On a subsequent POST, the request is unauthorized because the authorizationRequest map is not up to date in the session.